Connect WooCommerce to Store MCP
Checked against official docs on .
Enter your store origin in Store MCP and authorize on your own WooCommerce site; do not paste API secrets into chat.
Platform summary
Supported work
- Read and edit supported listings
- Read and set inventory
- Read orders (read-only)
Not supported
- Fulfillment and tracking changes
- Refunds
- Cancellations
Writes need a paid plan, permission and provider support. Actual grants may be narrower.
Prerequisites
You need an administrative store login authorized to grant the required WooCommerce access, a public HTTPS origin and a working current WP REST API v3. Store MCP requires pretty permalinks and a store installed at the origin root.
Steps
- In Stores, choose WooCommerce and enter the store origin, for example https://shop.example.com. The example domain is synthetic.
- Continue to the native WooCommerce authorization page on that exact host. Review the requested access and authorize there.
- WooCommerce sends the scoped key directly to Store MCP. Return to Stores and run the connection check; verify the saved domain.
- Authorize your AI for View only access, list products and read one known product and its inventory.
Safe example
The example uses synthetic names. Select your own authorized store and verify every identifier before a write.
Read one known product from my selected WooCommerce store. Show its type, SKU, variation coverage and stock tracking state. Do not change the product or ask me for consumer keys.You’re done when…
Expect a verified domain and a normalized product whose title and SKU match the store dashboard. If the callback has not completed, a return to the website alone does not establish a healthy connection.
Limitations
Hosting and plugins vary. Live acceptance used a temporary test store, not every hosting configuration. Order writes, standardized tracking and order events are unavailable.
Connection requirements and diagnosis
Store MCP accepts a public HTTPS origin, without username/password, query, fragment or subdirectory path. Use the final canonical hostname. Fix certificate, redirect and origin-mismatch problems at the host; do not disable TLS checks or put keys in URL query strings.
A firewall, security plugin or proxy may block wc-auth, wp-json/wc/v3 or the outbound callback. Check host logs privately, preserve Authorization headers and verify pretty permalinks. Do not weaken the entire site firewall to make a connection work. Revoke unused provider keys after failed setup attempts.
Simple and variable products
Simple and variable products are readable. listings.create creates simple products only. listings.update does not create or edit variations. Read variations to find their opaque inventory identifiers, then use supported inventory.set on the exact row.
WooCommerce inventory uses an expected-quantity check followed by a provider update; a concurrent dashboard change can still race. Missing or untracked stock is null, not zero. inventory.adjust and standardized location discovery are unavailable.
Supported seller work
Read simple and variable products, inspect stock and read orders. Create and edit simple products, change supported publication states and manage images. Variation creation and variation editing through listing updates are not exposed. Inventory updates can target the returned product or variation inventory row.
No standardized location discovery, fulfillment writes, tracking updates, refunds, cancellations or order-event ingestion are supplied by this connector. An installed shipping extension does not automatically add Store MCP capabilities.
Availability and verification
Deterministic fixtures cover request construction and normalization. Scoped staging acceptance on September 17, 2026 verified native authorization and a simple draft with SKU, price and stock on WordPress 7.1 / WooCommerce 11.1. The temporary test host is not a promise about every plugin, host or production store.
Hosting requirements
Use a public HTTPS origin with WP REST API v3 and pretty permalinks. Store MCP does not accept a URL containing credentials or a subdirectory deployment. Your host must preserve authorization headers and allow the native authorization callback.
Sources and verification
Official documentation checked 2026-09-21. This is a documentation review, not a new live provider or client acceptance run.